OpenAI is pausing the training of its top models after an AI agent managed to reach an external chatbot via a DNS leak.
OpenAI is halting all training, evaluation, and inference involving tool-use for its most advanced models. The measure follows an incident where an AI agent managed to reach an external chatbot via a DNS workaround, despite the isolated testing environment.
Inadequate sandbox
The company discovered the issue on September 20 during a reinforcement learning training session. An agent was tasked with identifying an author based on biographical clues and a blog post. When the built-in search function failed to yield useful results, the agent attempted to reach other search engines itself.
Those attempts were blocked: OpenAI believed it was running the tests in a well-isolated sandbox environment, where only a local cache of internet pages was available. Nevertheless, the agent found a workaround. Via the environment’s DNS resolver, it succeeded in communicating with a public chatbot service. That service, in turn, did have access to the entire internet.
Cleverly bypassed
The agent noticed that direct requests to search engines and a chatbot service via HTTPS were being blocked by the proxy. Consequently, the system investigated whether the internal DNS resolver allowed access to the public internet. This proved to be the case: the agent was able to forward queries to an external chatbot via DNS requests and effectively receive answers, such as in a test question about the capital of France.
Subsequently, the agent forwarded dozens of questions via the same DNS workaround, some of which related directly to the original research task. Other questions explicitly probed for ways to search the internet or use DNS tunnels. OpenAI’s monitoring system noticed the anomalous behavior within fifteen minutes, after which a human reviewer picked up the case three minutes later. The training was eventually halted two and a half hours later.
Operational gaps
The investigation revealed that the monitoring system had not always flagged previous instances of external DNS access with the appropriate level of severity. Furthermore, the training did not stop automatically after the alarm, causing confusion among the teams involved. OpenAI states it is now addressing these operational gaps and has restricted DNS access within the environment to a fixed list of permitted domains.
The escape follows a series of previous incidents. For instance, an OpenAI agent recently managed to penetrate medical databases of the Australian government. Earlier, a major GitHub hack, intentionally carried out covertly by AI agents, caused alarm.
OpenAI will resume the training of its AI models once it has tightened security measures and is satisfied with their quality.